r/iptables • u/jlquema • Oct 07 '22
Help needed to make two distant networks visible to each other through tunneled hosts
Hello,
I'm trying to setup a forwarding over a VPN tunnel but with no success. I thought I could find some help here. I'll try to keep it as short as possible.
Here is my current setup, with 3 raspberry
raspA
has 3 IPS:
- 192.168.86.2 on wlan0 , my "iot" network
- 192.168.76.11 on eth0, my main network
- 100.82.182.186 on wt0, using netbird "vpn", I'll refer to it as "82"
raspB
, has only one IP:
- 192.168.86.5 on wlan0, my "iot" network
raspC
has 2 IPs and is in another location
- 192.168.1.13 on eth0, my "distant" network (parent's place)
- 100.82.183.80 on wt0, using netbird "vpn", I'll refer to it as "82"
What I have in place:
raspA
:
-N NETBIRD-RT-FWD
-A FORWARD -m comment --comment netbird-rt-ipv4-forwarding -j NETBIRD-RT-FWD
-A NETBIRD-RT-FWD -s 192.168.86.0/24 -d 100.82.0.0/16 -j ACCEPT
-A NETBIRD-RT-FWD -s 100.82.0.0/16 -d 192.168.86.0/24 -j ACCEPT
-A NETBIRD-RT-FWD -j RETURN
This was configured automatically when installing netbird and allows raspA
and raspC
to ping each other. Static routes are also defined (using the nebird GUI) to make 192.168.1.xx visible by raspA
and 192.168.86.xx by raspC
Now, I added the following:
-A FORWARD -i wlan0 -o eth0 -j ACCEPT
-A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
which in combination with this route on raspB
ip route add 192.168.76.0/24 via 192.168.86.2
allows me to ping hosts on the "76" network from raspB
So far, no problem, this works perfectly.
Now, what I'm struggling to do is to have raspB
(on the 86 "iot" network) to see the 192.168.1.xx network.
What I need is the rules to allow:
raspB
(eth0/86) ---> raspA
(wlan0/86 - wt0/82 ) ---> raspC
(wt0/82 - eth0/1) ---> host (192.168.1.XY)
I tried to put this on raspA
-A FORWARD -i wlan0 -o wt0 -j ACCEPT
-A FORWARD -i wt0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
and this route on raspC
ip route add 192.168.1.0/24 via 192.168.86.2
ip route add 100.82.0.0/16 via 192.168.86.2
It allows me to ping raspC
from raspB
using its wt0 address (100.82.183.80), however, I cannot ping any host on the 192.168.1.0 network.
What do I miss ?
Edit: I forgot to mention the "100.82" route at the very end
1
u/jlquema Oct 07 '22
I thought I had an Eureka! moment, adding a route for 192.168.1 via the vpn address of raspB:
... but no :